Analysis
-
max time kernel
92s -
max time network
23s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-08-2021 08:24
Static task
static1
Behavioral task
behavioral1
Sample
911.exe$.exe
Resource
win7v20210408
General
-
Target
911.exe$.exe
-
Size
78KB
-
MD5
50c4970003a84cab1bf2634631fe39d7
-
SHA1
721a749cbd6afcd765e07902c17d5ab949b04e4a
-
SHA256
520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57
-
SHA512
fb210c92f7d1be9f9361b11dffd30fac78eeaadabf844a78a7dad00169f994d089c1cf4a037d6a1b82fddf35a6bfa34b8cbf216ce1786f407dfc015c72533504
Malware Config
Extracted
C:\1rWCqamCt.README.txt
blackmatter
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/0JOA98TDMXLHJ77VDOO
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\LimitDisable.raw.1rWCqamCt 911.exe$.exe File renamed C:\Users\Admin\Pictures\LimitTest.tiff => C:\Users\Admin\Pictures\LimitTest.tiff.1rWCqamCt 911.exe$.exe File opened for modification C:\Users\Admin\Pictures\LimitTest.tiff.1rWCqamCt 911.exe$.exe File renamed C:\Users\Admin\Pictures\RepairWait.tif => C:\Users\Admin\Pictures\RepairWait.tif.1rWCqamCt 911.exe$.exe File renamed C:\Users\Admin\Pictures\ResumeOptimize.crw => C:\Users\Admin\Pictures\ResumeOptimize.crw.1rWCqamCt 911.exe$.exe File renamed C:\Users\Admin\Pictures\LimitDisable.raw => C:\Users\Admin\Pictures\LimitDisable.raw.1rWCqamCt 911.exe$.exe File opened for modification C:\Users\Admin\Pictures\LimitTest.tiff 911.exe$.exe File opened for modification C:\Users\Admin\Pictures\RepairWait.tif.1rWCqamCt 911.exe$.exe File opened for modification C:\Users\Admin\Pictures\ResumeOptimize.crw.1rWCqamCt 911.exe$.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1rWCqamCt.bmp" 911.exe$.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1rWCqamCt.bmp" 911.exe$.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1028 911.exe$.exe 1028 911.exe$.exe 1028 911.exe$.exe 1028 911.exe$.exe 1028 911.exe$.exe 1028 911.exe$.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International 911.exe$.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop 911.exe$.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" 911.exe$.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2000 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1028 911.exe$.exe 1028 911.exe$.exe 1028 911.exe$.exe 1028 911.exe$.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 752 splwow64.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 1028 911.exe$.exe Token: SeDebugPrivilege 1028 911.exe$.exe Token: 36 1028 911.exe$.exe Token: SeImpersonatePrivilege 1028 911.exe$.exe Token: SeIncBasePriorityPrivilege 1028 911.exe$.exe Token: SeIncreaseQuotaPrivilege 1028 911.exe$.exe Token: 33 1028 911.exe$.exe Token: SeManageVolumePrivilege 1028 911.exe$.exe Token: SeProfSingleProcessPrivilege 1028 911.exe$.exe Token: SeRestorePrivilege 1028 911.exe$.exe Token: SeSecurityPrivilege 1028 911.exe$.exe Token: SeSystemProfilePrivilege 1028 911.exe$.exe Token: SeTakeOwnershipPrivilege 1028 911.exe$.exe Token: SeShutdownPrivilege 1028 911.exe$.exe Token: SeBackupPrivilege 760 vssvc.exe Token: SeRestorePrivilege 760 vssvc.exe Token: SeAuditPrivilege 760 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 752 splwow64.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2000 1028 911.exe$.exe 35 PID 1028 wrote to memory of 2000 1028 911.exe$.exe 35 PID 1028 wrote to memory of 2000 1028 911.exe$.exe 35 PID 1028 wrote to memory of 2000 1028 911.exe$.exe 35 PID 2000 wrote to memory of 752 2000 NOTEPAD.EXE 37 PID 2000 wrote to memory of 752 2000 NOTEPAD.EXE 37 PID 2000 wrote to memory of 752 2000 NOTEPAD.EXE 37 PID 2000 wrote to memory of 752 2000 NOTEPAD.EXE 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\911.exe$.exe"C:\Users\Admin\AppData\Local\Temp\911.exe$.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" /p C:\1rWCqamCt.README.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:752
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:760